Hacker News Reader

Comment by cperciva | Hacker News Reader

Worse than that: I've encountered a few web sites which accept email addresses with '+' characters... and then tell me that my email address has a ' ' character in it. Every time I see this I think "there's got to be a multiple-form-decoding vulnerability here"...

View on HN

I've got an account where they just plain stripped the + character. Since I happen to have used only alphanumeric charters after, I am now registered with an email address I can't actually receive mail on - it goes to somebody else's inbox.

Account synchronization was involved - IIRC the initial address confirmation message got thorough.

I thought that though the + is valid, nothing after the + is used to differentiate the email address? I use local+Organization when I sign up for an email list so that I can easily filter, plus I can see if that email address gets shared around. So on places that reject the + I just use everything before it as the local part. Maybe I'm missing something. Edit: I guess not all email providers do it this way but here's a link to more info: https://www.cs.rutgers.edu/~watrous/plus-signs-in-email-addr...

Yeah, of course it will work, but then it's harder to filter their mail to an appropriate folder.

As far as email is concerned, "+" is just a character as any other. You might as well configure your mail server to ignore everything from the first "g" in the localpart when figuring out which mailbox to deliver to. Some mailservers happen to do this with a "+", if it happens to occur in a localpart, but that is just what they happen to be doing. There is nothing technically wrong with an email address like "++foo@example.net" or "x+y+z@example.net" or "+-@example.net", and "a+b@example.net" is a different address than "a+c@example.net", unless the operator of example.net explicitly specifies otherwise.

So this is true on the email provider side, sometimes. Gmail (and a lot of others) rout foo+bar@gmail to foo@gmail. It's not required, but it's common.

The problem here, though, is that the email sender just stripped the + and sent the content to foobar@gmail.com. That's just a totally different account, chosen without warning.

Southwest (Airlines) does this... or did a few years ago.

Had this problem with Virgin Atlantic. Booked a ticket, never got it.

...and they probably send the confirmation mail to two addresses, both wrong.

Reply on news.ycombinator.com